CVE-2016-20039
Published: 28 March 2026
Summary
CVE-2016-20039 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Mamedev (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 4.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2016-20039 is a stack-based buffer overflow vulnerability in the gamma parameter handling of Multi Emulator Super System (MESS) version 0.154-3.1. The flaw occurs when an oversized gamma parameter value is supplied, overflowing a stack buffer and allowing attackers to overwrite the instruction pointer with a controlled address. This CWE-787 issue, published on 2026-03-28, carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to potential for crashes or arbitrary code execution.
Local attackers can exploit this vulnerability by providing a maliciously crafted gamma parameter, enabling them to crash the MESS application or achieve arbitrary code execution on the host system. No user privileges or interaction are required, and the attack complexity is low, making it accessible to any local user with the ability to invoke the affected component.
References include the MAME development site at http://mamedev.org/, an Exploit-DB entry at https://www.exploit-db.com/exploits/39673, and a VulnCheck advisory at https://www.vulncheck.com/advisories/multi-emulator-super-system-buffer-overflow, which security practitioners should review for additional details on exploitation and potential mitigations such as software updates.
A proof-of-concept exploit is publicly available on Exploit-DB, demonstrating practical exploitability in controlled environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2016-10833
Vulnerability details
Multi Emulator Super System 0.154-3.1 contains a buffer overflow vulnerability in the gamma parameter handling that allows local attackers to crash the application or execute arbitrary code. Attackers can supply an oversized gamma parameter value to overflow the stack buffer…
more
and overwrite the instruction pointer with a controlled address to achieve code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in local client application (MESS emulator) directly enables arbitrary code execution via crafted input parameter with no privileges or user interaction required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the buffer overflow vulnerability by applying patches or updates to fix the gamma parameter handling in MESS.
Information input validation enforces bounds checking on the gamma parameter to prevent oversized values from overflowing the stack buffer.
Memory protection mechanisms like stack canaries, ASLR, and non-executable stack prevent exploitation of the buffer overflow for code execution.